Security policy

Keep vulnerability details out of public issues and examples. This page records supported package lines, the enabled private intake, scope, and a safe fallback for temporary service unavailability.

Do not publish vulnerability details. Public issues, pull requests, discussions, logs, screenshots, and forks are visible to everyone.

Supported versions#

Security fixes are provided for the latest published minor line only. Reproduce on its latest patch before reporting. Canonical package files come from PyPI; the current stable release has a dedicated 1.0.1 page.

Private reporting channel#

The canonical private-report URL is: report an APIZIT Linking vulnerability privately.

Status: GitHub Private Vulnerability Reporting is enabled for this repository. Submit technical details only through that private form.

If the private form is temporarily unavailable, create only a minimal security contact request asking a maintainer for a private channel. Include no vulnerability details, proof of concept, logs, customer information, secrets, or sensitive paths.

What to include privately#

• APIZIT Linking and Python versions;
• affected component and deployment context;
• impact and realistic attack preconditions;
• minimal reproduction steps or a proof of concept;
• possible mitigation, if known;
• whether the issue has been disclosed elsewhere.

Maintainers aim to acknowledge a complete report within three business days and provide an initial assessment within seven business days. Coordinate any publication so a verified fix and update guidance can reach users first.

Scope#

This policy covers:

• the apizit-linking package distributed on PyPI;
• compiler, artifact validation, FastAPI adapter, and preview CLI behavior;
• the public schema, examples, documentation, and release metadata here.

The hosted APIZIT product has a separate operational security process. Customer applications, customer-selected dependencies, and unrelated infrastructure are not automatically in scope.

Preview trust boundary#

apizit-linking preview imports and executes linked project code. It is a local development server for trusted source, not a sandbox, authentication boundary, or production server. Merely executing deliberately malicious trusted project code is not a sandbox escape because no sandbox is promised.

Non-security bugs#

Use the public bug form for ordinary defects. Sanitize commands and diagnostics before posting them. The repository copy of SECURITY.md is the concise source-controlled version of this policy.